for your information

Security & trust

A plain-language summary of where the data lives, who can touch it, and what happens when things break. Aimed at procurement, but useful for anyone curious.

1. Data sources & licensing

All datasets in eolas come from public NZ government and intergovernmental sources. We don't generate or transform the underlying values — we package the data into one consistent API.

Most NZ government sources publish under CC-BY 4.0 — free for any use, including commercial, with attribution.
OECD data has tighter redistribution terms; we expose it for read-only API access and direct OECD-attribution links in dataset metadata.
Stats NZ Geospatial / LINZ via Koordinates also CC-BY 4.0; attribution string included in every response.

Every /v1/datasets/{name}/data, /v1/bulk/…, and changelog feed response carries X-Eolas-Attribution and X-Eolas-Licence headers (same wording as bulk NOTICE.txt). Snowflake share consumers query eolas.EOLAS_META.ATTRIBUTIONS.

Every dataset detail page links to the canonical source so you can verify lineage yourself. We have no exclusive rights to any of this data — you could always fetch it directly. eolas just saves you the scraping.

2. Hosting & geography

Region: AWS Sydney (ap-southeast-2) — the closest commercial region to New Zealand.
Data lake: Apache Iceberg tables on S3 (s3://vs-warehouse/), catalogued in AWS Glue. Open format — no vendor lock-in.
Serving: Two FastAPI services on EC2 behind nginx, fronted by Cloudflare (proxied — WAF + DDoS protection) over Let's Encrypt TLS. The origin accepts traffic only from Cloudflare: Authenticated Origin Pulls (mutual TLS) reject any connection without Cloudflare's client certificate, and the security group is locked to Cloudflare's IP ranges.
Enterprise share: Snowflake zero-copy data share over the same Iceberg files — you pay your own Snowflake compute, we don't sit in the data path.
ETL: AWS Fargate, scheduled by EventBridge in NZ time. One container per pipeline, ephemeral and idempotent.

3. Uptime & observability

Live status: eolas.fyi/status — checks DB, S3, Glue catalog, and dataset index every minute, no auth required.
External monitoring: Better Stack pings /health/full every 3 minutes from outside AWS; email alerts on failure.
Error tracking: Sentry on both web and API services. We see exceptions before customers do.
Pipeline failures: EventBridge → Lambda → SMTP alert if any ETL container exits non-zero. Phil gets paged automatically.
SLA: Free / Pro plans are best-effort. Enterprise customers get a written SLA — typically 99.5% monthly uptime on the API surface, with refresh-cadence guarantees per dataset. Summary: docs.eolas.fyi/sla.

4. Application security

Transport: HSTS enforced; HTTP 80 redirects to 443 unconditionally; Cloudflare-proxied with Authenticated Origin Pulls (mTLS) so the origin rejects any non-Cloudflare request.
Security headers: Content-Security-Policy (incl. frame-ancestors), X-Frame-Options, X-Content-Type-Options: nosniff, Referrer-Policy, Permissions-Policy, HSTS — set at the nginx layer and version-controlled.
API authentication: X-API-Key verified by SHA-256 hash; the displayable copy is encrypted at rest (Fernet). Rotate any key from your dashboard.
Account security: bcrypt passwords; HttpOnly + Secure + SameSite=Lax session cookies; CSRF tokens on every state-changing form; Cloudflare Turnstile on auth forms.
Brute-force defence: per-IP rate limits (login 5/15min, signup 10/hr, reset 3/hr) plus per-account lockout after repeated failures — keyed on the account, so rotating IPs doesn't evade it.
Two-factor auth: optional TOTP 2FA with one-time recovery codes, enforced at login for enrolled accounts (optional 30-day trusted device).
Session hygiene: a password reset or change invalidates all existing sessions and the trusted-device cookie, and rotates the account API key.
Monitoring: failed admin logins, account lockouts, and admin access-control denials are logged and alerted (Sentry + email).
Stripe webhook: HMAC-SHA256 verified; replay protection via timestamp window and event-id deduplication. Restricted-scope key on the server — never a full-account sk_live_.
Secrets & access: secrets in root-only systemd drop-ins (never in git); AWS via IAM instance roles (no long-lived keys); no public SSH — port 22 is removed from the security group, operator access is AWS SSM Session Manager only.
Supply chain: Dependabot + pip-audit in CI; deploys ship only committed code (git archive), never a working tree.

5. Privacy & PII

No customer PII in the data layer. The datasets we serve are public-source statistical aggregates; no individual records.
Account data: email, name, hashed password, plan tier, API key hashes, request logs (key hash + method + path + status + duration, no payloads). Stored in SQLite on the API box, backed up daily to S3 Glacier.
Analytics: Plausible (cookieless, GDPR-clean, no IP retention, no fingerprinting). No Google Analytics.
Email: Resend (US-based), used only for transactional mail — verification, password reset, billing notifications.
Stripe: Payment data never touches our servers. Stripe is PCI-DSS Level 1.
Your rights: Under the NZ Privacy Act 2020 (and GDPR if applicable), you can request a copy of, or deletion of, your account data at any time. See privacy policy or email [email protected].

6. Incident response

If something breaks badly enough to affect customers — outage, data quality regression, security event — here's what happens:

Sentry / Better Stack / EventBridge alert fires within minutes.
Status page is updated to reflect the affected subsystem.
For security-relevant incidents: affected customers are emailed within 72 hours of confirmation (NZ Privacy Act default).
Post-incident review published as a Changelog entry within 7 days.

Report a vulnerability privately at [email protected]. We commit to acknowledging within one working day.

7. Subprocessors

Third parties that process data on eolas's behalf. The datasets themselves are public; the only customer data involved is account/billing metadata.

Amazon Web Services — hosting, storage, compute, backups — infrastructure + account database + daily backups — AWS Sydney (ap-southeast-2).
Cloudflare — CDN, WAF, DNS, DDoS protection, Turnstile — request metadata in transit — global edge.
Stripe — payment processing (PCI-DSS Level 1) — billing & payment data (never stored on our servers) — US / global.
Resend — transactional email — name + email for verification, reset, and billing mail — US.
Sentry — error monitoring — exception data + request context — US / EU.
Better Stack — uptime monitoring + log management — health-check and log data — EU.
Plausible Analytics — cookieless web analytics — aggregate page views, no PII, no IP retention — EU.
Snowflake — enterprise data share (customer-initiated) — public dataset data only; you run your own compute in your chosen region.

We'll give notice of material subprocessor changes to Enterprise customers under contract. A Data Processing Addendum is available on request.